If you use enforcement policies with Conditions like: "connection:NAD-IP-Address:Belongs_to_group:groupname" - you're unable to change existing or create new rules of this type. I just get a javascript error, and I've tried in Chrome, Firefox, IE.